I agree and disagree. The challenge with HIPAA isn't really the technical safeguards. It's processes and controls you have in place to make sure that you don't

I agree and disagree. The challenge with HIPAA isn't really the technical safeguards. It's processes and controls you have in place to make sure that you don't violate HIPAA. On a small team, this is pretty easy to have your CTO take this responsibility simply by being involved in EVERYTHING. At a certain point that breaks, then you need good processes. Personally, the biggest pain of HIPAA is actually the product restrictions (or requirements) rather than the technical requirements. * Lots of limitations on how you can use and share information * Lots of requirements for durability/accessibility/forgettability * Lots of mindfulness of where you store data and what has access to that data. For example, look at cookies. It's a best practice to not store sensitive data in there. In a non-HIPAA environment, you don't really have to worry about it. Worst case, you identify the problem and resolve it. In a HIPAA environment, the could result in a violation, so you need to build a process to avoid storing sensitive data in an insecure manner. Extrapolate to a bunch of different risks and suddenly you have a lot of surface area to look after.